> Thanks for those interesting links. However, neither seems to give
> information as to the reasoning behind the "evaled parameters security
> risk"... maybe I am just missing the obvious,
I'll try to restate the risk as best I can.
If a space A includes content from another space B, then when I visit
space A,that content from B will act as if it were part of space A.
If space B publishes executable content, then that content will be
executed in the context of space A.
Executable content includes:
- systemConfig tiddlers
- computed macro parameters
- <HTML> blocks containing JavaScript code
- MarkupPreHead and it's siblings
If I am a member of space A then the JavaScript within that space
(including that which came from space B) has the same access as me -
it can read and write to both the private and public bags.
If the executable content in space B is mischevious, therefore, it can
steal or modify my private content.
An example of mischievous content within a tiddler from space B:
<<tiddler {{window.store.deleteAllTiddlers();"HelloThere";}}>>
The effect of that example would be to invoke a (hypothetical) core
function to delete all tiddlers.
So, the issue is that as things currently stand including a space can
be dangerous from an information security viewpoint.
We're not trying to make it impossible to do dangerous things, we
think they are often rather useful. We're trying to avoid people
inadvertantly doing dangerous things.
To make space inclusion safe we need to be able to filter out
executable content.
In order to do that we need to be able to distinguish executable
content from ordinary, safe wikitext content.
With the computed macro parameters as currently implemented, it isn't
possible to make that distinction.
Hence the change.
Best wishes
Jeremy
--
Jeremy Ruston
mailto:jer...@osmosoft.com
http://www.tiddlywiki.com
--
You received this message because you are subscribed to the Google Groups
"TiddlyWiki" group.
To post to this group, send email to tiddlyw...@googlegroups.com.
To unsubscribe from this group, send email to
tiddlywiki+unsubscr...@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/tiddlywiki?hl=en.
